Lecturer: Configuring a SIEM agent. 2 2
In this lesson, I'm going to go into my lab environment 3 3
and show you how to configure 4 4
a security information and event management system. 5 5
Now, we're going to make sure 6 6
that we get the agents on the systems in our network 7 7
configured so they can report back to that SIEM 8 8
so we can use that for later analysis. 9 9
Now, in this lesson, I'm going to use Security Onion, 10 10
which is an appliance that comes as a VM, 11 11
and it implements things like Elastic Stack, Kibana 12 12
and other SIEM functionalities within it. 13 13
Now, the first thing we're going to do 14 14
is we're going to go and configure our sensor. 15 15
Now, I've already done this for us, 16 16
but if you look on the right side of this diagram, 17 17
you're going to see the unified threat management system 18 18
up at the top. 19 19
On that, we have a connection going to vLOCAL, 20 20
and vLOCAL has a sensor feeding data into my SIEM. 21 21
Now, in addition to that, 22 22
I'm also going to be collecting information 23 23
from the Windows virtual machines down in the bottom, 24 24
MS1 and DC1. 25 25
Both of those have data that's being fed up into vLOCAL, 26 26
and using that sensor port, 27 27
I'm going to collect that information, 28 28
and send it to my SIEM. 29 29
All right. 30 30
So the next thing I want to do is go into my SIEM, 31 31
and we're going to open a terminal, 32 32
and from within here, 33 33
we're going to start dumping that information from the network 34 34
that we're capturing over that sensor wire. 35 35
So I'm going to type in sudo tcpdump -ni eth1 ip and hit enter. 36 36
Using the -n switch is going to tell us 37 37
that we don't want to use name resolution 38 38
because I'm not connected to the internet 39 39
so I can't look up things like google.com. 40 40
I have to use IP addresses. 41 41
And by using the IP at the end, 42 42
this is going to filter out any IPv6 traffic. 43 43
So I'm just going to be focused on IPv4 traffic. 44 44
This will make sure that I see things for traffic going to 45 45
and from my host in those two Windows machines 46 46
and to that unified threat management system. 47 47
All right, once I'm done capturing this, 48 48
I'm going to hit Control + Z 49 49
and that will stop this traffic capture. 50 50
Now, this traffic is going to be monitored by Bro. 51 51
Bro is a passive network sensor that we're going to use. 52 52
Basically, it's an intrusion detection system. 53 53
It's part of that unified threat manager. 54 54
Now, those events have already been configured 55 55
so it's going to write into the SIEM. 56 56
The SIEM is going to allow me to see what's in there 57 57
and we're going to use Elastic Stack to do that. 58 58
So if I go ahead 59 59
and see if Elastic Stack is running properly, I can do this 60 60
by typing in sudo space so-status and hit enter. 61 61
This will give me the output that shows 62 62
that each service is up and okay. 63 63
If I get some kind of a warning message 64 64
that means one of the things that I'm using to collect this, 65 65
things like logstash, which is part 66 66
of Elastic Stack might not be quite ready yet 67 67
so I would have to wait and then run that status again. 68 68
All right, from my desktop, I'm going to go ahead 69 69
and open up Kibana. 70 70
Inside of Kibana, I'm going to log in with my username 71 71
and password and this is going to bring me to a dashboard. 72 72
Kibana is a virtualization tool 73 73
and it's part of Elastic Stack. 74 74
It's going to be used to configure the dashboards 75 75
for different categories, showing us different information 76 76
in a graph format or a table format. 77 77
Now, if I go down under Bro Hunting, 78 78
I can select connections 79 79
and from here I can scroll down to verify that the host 80 80
from the 10.1.0.0/24 network are present 81 81
and accounted for. 82 82
This will make sure 83 83
that I'm seeing the information being sent 84 84
to me by my intrusion detection system. 85 85
All right, now 86 86
that we see the Kibana is properly configured, 87 87
I want to start doing some scans and make sure 88 88
that Kibana is seeing this inside of there with live data. 89 89
So I'm going to go into Zenmap, which is on my Windows machine 90 90
and I'm going to run a scan using a default intent scan 91 91
against 10.1.0.1. 92 92
Now, Zenmap is essentially just a graphical version of Nmap, 93 93
which is a network scanner. 94 94
So it's going to go through and perform the scan for me. 95 95
And now I'm going to go back into Kibana. 96 96
If I go there under alert data, 97 97
I can then view the Bro notices 98 98
and NIDS categorization for scanning activity alerts. 99 99
Now, if there are no results, 100 100
you want to click on the update button. 101 101
Now, as we do this, we should be detecting that scan 102 102
that the Windows machine is doing against this network 103 103
and Kibana as the SIEM is seeing all that data 104 104
because we have that port mirroring enabled 105 105
off of that switch. 106 106
Now, as you can see here, 107 107
the NIDS alerts are being counted and we can see those scans 108 108
because we have this scan being run by our Zenmap. 109 109
So this is telling me this process is working 110 110
and we're able to see it in real time. 111 111
Now, the next thing we want to look at 112 112
is how to install a Beats agent 113 113
so we can capture network traffic directly 114 114
from the host instead of just capturing things 115 115
off of the network switch using port mirroring 116 116
like we were doing up to this point. 117 117
To do this, we want to capture that log information. 118 118
So we're going to install the Beats agent. 119 119
So let me go ahead and log into my DC1 120 120
and from here I want to configure Beats 121 121
and I do that by going under my lab files. 122 122
And then win logbeat. 123 123
In here, you'll see winlogbeat.yml 124 124
which is the configuration file 125 125
and I'm going to right click it 126 126
and edit it with Notepad++. 127 127
Now, as I edit this file, you have to remember 128 128
that YAML files are very sensitive to white space. 129 129
So every space is actually used and counted. 130 130
So you can't just add spaces willy-nilly, 131 131
you got to make sure you count correctly. 132 132
These files use two spaces per indentation level 133 133
so if you want to use two, that would be the first column. 134 134
Two more. 135 135
That gives you four spaces, 136 136
that's the second column and it keeps going like that. 137 137
All right, so we're going to scroll down and locate 138 138
where it says output.logstash colon. 139 139
Now, in this section, I'm going to find line 111, 140 140
which is the hashtag, hosts colon, and I want to change 141 141
where it says localhost to my IP address of my SIEM 142 142
so I can send the data from this machine over 143 143
to the SIEM and that SIEM is at 10.1.0.246. 144 144
So my line should now read hosts: space, space, 145 145
quote, 10.1.0.246:5044, quote. 146 146
And that 5044 is the port that my SIEM 147 147
is configured to listen on. 148 148
Now, this will allow me to get data from this, 149 149
any of the log files 150 150
and send it back to that SIEM, 151 151
which gives me another way to collect data. 152 152
So I'm going to save this and close the file 153 153
and then I'm going to copy the winlogbeat folder 154 154
to the C:\Program Files x86 directory. 155 155
Now, I'm going to go into PowerShell 156 156
and run a command to be able to start this up. 157 157
So I'm going to change directories 158 158
into the C:\Program Files x86/ winlogbeat directory 159 159
that I just started. 160 160
Then I'm going to run winlogbeat. 161 161
And to do this, I'm going to use the Linux style notation. 162 162
So ./winlogbeat space test space config 163 163
space -c space winlogbeat.yml, space -e. 164 164
And what this says is I'm going to run winlogbeat, 165 165
I'm going to use it in a test in configuration mode 166 166
and the configuration file is going to be winlogbeat.yml. 167 167
And then I'm going to execute this. 168 168
So this last part is going to say configure OK. 169 169
Now, if there is an error, 170 170
that means I messed up the configuration file, but if not, 171 171
I'm ready to keep going. 172 172
Now, at this point, I'm going to run two more commands 173 173
'cause I need to install that agent 174 174
as a service inside Windows 175 175
so it starts up every time I reboot this computer. 176 176
To do this, I'm going to do ./install-service-winlogbeat, 177 177
and then I'm going to start the service 178 178
by doing start-service space winlogbeat. 179 179
All right, now that I have that running, 180 180
I have started this up, I have configured it 181 181
as a service and anytime I restart this computer, 182 182
Beats is going to be running for me. 183 183
So let me go back into my SIEM now 184 184
and I want to run the command sudo space so-allow-view. 185 185
Now, this is going to show me the output 186 186
that has the firewall that's already been configured 187 187
to allow the traffic from Beats 188 188
over port 5044 into my SIEM. 189 189
Now, if I go back into Kibana, I should again see 190 190
those NIDS dashboards and those Bro notices 191 191
for those scan alerts that I saw before 192 192
from those scanning alerts that I caused by using Zenmap. 193 193
Now, if I go under the Beats dashboard under Host Hunting, 194 194
I can start seeing events from DC1 where I just started 195 195
that Beats agent to send data back. 196 196
Now, it may take some time 197 197
for that to come in and if yours aren't there yet, 198 198
you can click on update or refresh and keep checking 199 199
for those alerts. 200 200
Over time, they're going to start coming in 201 201
and you'll see those different logs from that system. 202 202
Now, the next thing I'm going to do is configure 203 203
some application logging. 204 204
Now, by default, 205 205
Beats is going to capture the application, system 206 206
and security logs when you set it up on a Windows server. 207 207
Now, this is going to collect a lot of data 208 208
and send a lot of it back to our SIEM and some 209 209
of it may or may not be relevant for what you want to do. 210 210
If you're doing incident detection or threat hunting, 211 211
a lot of this just isn't something you need. 212 212
If you're doing system troubleshooting, 213 213
it's stuff you may need. 214 214
So you need to figure that out inside your organization 215 215
and determine what you want to log and how much. 216 216
So let's say we want to configure our application log. 217 217
So we're starting to send data to the SIEM. 218 218
Well, let's go over to MS1, 219 219
which was my IIS server machine. 220 220
And I want to go in there and look 221 221
at the access logs from the event viewer 222 222
and then have Beats forward that to the SIEM. 223 223
That way I can get data about my web server. 224 224
So let me go ahead and go into MS1. 225 225
And from here, I'm going to go under Server Manager, 226 226
select tools and then Internet Information Services 227 227
or IIS Manager. 228 228
Inside the IIS Manager, 229 229
I'm going to select the server MS1 230 230
and I'm going to double click 231 231
on the logging app in the middle pane. 232 232
This will show me the different options I have 233 233
for log formats. 234 234
Now, if you remember from our log formatting lesson, 235 235
you're going to see that there's lots 236 236
of different formats you can use 237 237
but I'm going to use the standard of W3C, 238 238
which is really good for web application logs. 239 239
Now, under the log event destination, I can select 240 240
both the log file and an ETW event and click apply. 241 241
This means I'm going to log it locally 242 242
to the computer and I'm going to send it 243 243
as this type of event over through Beats. 244 244
Now, if I go to Explorer, I can copy the winlogbeat 245 245
from my domain controller that I installed it on before 246 246
to the local system here with MS1, my web server. 247 247
I'm then going to go into PowerShell as an administrator 248 248
and I need to run this big, long, scary command. 249 249
Now, again, this is something you don't have 250 250
to memorize for the exam 251 251
but it is what we need to run to be able to check the name 252 252
of the event log that's capturing those IIS events. 253 253
So I'm going to do get-winevent space 254 254
dash listlog space, star space 255 255
pipe space wear-object space, curly bracket, 256 256
space dollar sign underscore .logname space -like 257 257
space quote *IIS, quote *IIS* star quote, 258 258
curly bracket, space pipe space format -list 259 259
space -property space logname. 260 260
Woo, that was a long one. 261 261
So what is this saying? 262 262
Well, I want to get all 263 263
of the Windows events that meet these conditions. 264 264
If it's listing the logs that have a star, 265 265
meaning anything, I want to grab those 266 266
or I want to grab things where there's an object 267 267
where the logname has something 268 268
like IIS in it or I want to get anything that's formatted 269 269
as a list with the property of logname. 270 270
So if I take all those things, I can gather those events 271 271
and then I can figure out what I want. 272 272
This query is going to match a couple of logs, 273 273
in fact, three of them. 274 274
And then I want to copy the text 275 275
Microsoft-IIS-Logging/Logs 276 276
and copy the value from the prompt, 277 277
select it and press enter. 278 278
Now, I'm going to open up the Program Files directory 279 279
under winlogbeat that I just installed 280 280
and find that configuration file. 281 281
I want to go ahead into that file 282 282
and under the winlogbeat-event_logs, colon, 283 283
I want to add the text that says 284 284
-: name: Microsoft-IIS-Logging/Logs. 285 285
All right, now that I have this file configured 286 286
the way I want, 287 287
I'm going to close it and say yes to save it. 288 288
And then I'm going to go back 289 289
into my administrator mode and go into my PowerShell prompt. 290 290
I now want to run the command to get 291 291
into the directory for winlogbeat, 292 292
which is cd space C:\Program Files /winlogbeat. 293 293
And then I want to run the configuration file and load it up. 294 294
So just like I did 295 295
on the domain controller, ./ winlogbeat 296 296
test config -c winlogbeat.yml -e. 297 297
Now, if I got that last part right, 298 298
I'm going to see output that says config OK. 299 299
This means I'm ready to move on. 300 300
Now, I need to start it up as a service just like I did 301 301
on the domain controller. 302 302
./install-service-winlogbeat, hit enter 303 303
and then start-service space winlogbeat and hit enter. 304 304
Now, we have winlogbeat or Beats running 305 305
on both the domain controller and the web server. 306 306
Now, I want to be able to start generating some traffic here. 307 307
So I'm going to go over to my PC1 308 308
and my PC2 and I'm going to do some things like going 309 309
and accessing share drives or browsing to different websites 310 310
or using Zenmap to start scanning some things. 311 311
And when I do this, 312 312
this is going to generate some traffic for this lab environment 313 313
and it should generate both network traffic that's captured 314 314
by the SIEM based on that port mirroring 315 315
and it's going to capture application logs and event logs 316 316
from the domain controller and from the web server. 317 317
All right, the next thing I want to do is install 318 318
a host-based intrusion detection system. 319 319
And I'm going to do this 320 320
by using an agent on one of these clients. 321 321
So with the Windows clients, we are going to install OSSEC, 322 322
which is a HIDS agent. 323 323
Now, this is going to produce 324 324
only security-relevant information for us 325 325
and again, we want to configure that 326 326
to send that data back to our SIEM. 327 327
So I'm going to go into PC1 and I'm going to go ahead 328 328
and run this program called Wazuh, which is W-A-Z-U-H. 329 329
To run it, 330 330
I'm going to go into my lab files directory, 331 331
/wazuh-agent- the version number .msi. 332 332
This will start my installer. 333 333
I'm going to go through this installer pretty basically 334 334
and I'm going to accept and install it. 335 335
And when this setup is completed, 336 336
I'm going to click run agent configuration interface 337 337
and then click finish. 338 338
If I get a UAC prompt, 339 339
I'm going to go ahead and approve it and say yes. 340 340
Now, the next thing I want to do is open a command prompt 341 341
as the administrator and C:\Program Files x86 342 342
\ossec-agent\ahent-auth.exe -m 10.1.0.246 343 343
Remember, that's the IP address of my server. 344 344
So where am I sending these things? 345 345
I'm going to send 'em back to that same server. 346 346
All right, now that we've done that, 347 347
we've associated this agent 348 348
with the manager that's running on the SIEM. 349 349
That's what that -m is for. 350 350
Now, this will make sure there's a connection 351 351
between the two so I can send the data there. 352 352
Now, if I switch back to the Wazuh Agent Manager dialog, 353 353
I can click the refresh button 354 354
and I should see a key that's loaded 355 355
in the authentication key box. 356 356
If I go to the manager IP box, 357 357
I can type in my manager's IP address, that of the SIEM. 358 358
10.1.0.246. 359 359
Once I do that, 360 360
I'm going to save it and then select Manage, Start and OK. 361 361
Now, if I wanted to do this on the other PCs 362 362
in my network, I would do the exact same thing 363 363
and configure all of them the same way and that way all 364 364
of my devices can go back and reach to that SIEM. 365 365
All right, now that we've done that, let's go back 366 366
into our SIEM and start looking at some data. 367 367
We want to start extracting data 368 368
and aggregating these records to make use 369 369
of our SIEM and understand what's in there. 370 370
So inside my SIEM, I'm going to go under the OSSEC dashboard 371 371
under Host Hunting. 372 372
Here I'm going to use the update 373 373
or refresh to check for any new alerts. 374 374
Now, once I do that, I'm going to click the management tab 375 375
and select index patterns and then create index pattern. 376 376
Now, in the index pattern box, 377 377
I want to type log-ossec-* 378 378
and then click next step. 379 379
This is the pattern I'm identifying. 380 380
Then from the time filter, I can select I don't want 381 381
to use a time filter 'cause I want everything to show up 382 382
or I might just want to look at today's stuff 383 383
or the last three hour stuff or a certain time period based 384 384
on what we saw from some kind of a malicious event. 385 385
Now, once I've done that, 386 386
I can click the create index pattern button 387 387
and this creates my pattern. 388 388
From here, I can click the discovery tab. 389 389
Now, from the list box, 390 390
I want to select log-ossec-*, 391 391
which is the index pattern that I just created. 392 392
Now, under my search box, I want to create a filter string 393 393
and then I'm going to update it. 394 394
So I'm going to do this by typing in agent.name: PC* 395 395
AND alert_level colon: greater than or equal to five. 396 396
What this says is anytime you found an agent 397 397
that was PC something 398 398
in my network, PC1 or PC2, 399 399
and the alert level was greater than or equal to five, 400 400
I want you to display it. 401 401
Now, as I look at these results, I can see some results here 402 402
and I can click the small black arrow to expand the record 403 403
and view all of the different event data around it. 404 404
And so you can see pretty quickly here 405 405
how we can start slicing and dicing data 406 406
and searching for things on a particular machine, 407 407
such as PC1 or PC2, or if you wanted to look 408 408
at all machines by using wildcard characters 409 409
and then identifying 410 410
what looks malicious across your network. 411 411
The great thing about a SIEM is I'm not looking 412 412
at everything as individual pieces. 413 413
All that data is in one place, so I can see it 414 414
across the entire network and start looking for patterns. 415 415
Next, let's configure a syslog source. 416 416
Now, this is important because a lot 417 417
of hosts you're going to deal with 418 418
may not have the ability to install an agent 419 419
but most things can be configured 420 420
for remote syslog monitoring. 421 421
So to do this, I'm going to go ahead 422 422
and do that on my pfSense security appliance, 423 423
which is my unified threat management system. 424 424
So when I go into that unified threat management system, 425 425
I can click on status and system logs 426 426
and then click on the Settings tab. 427 427
Here, if I scroll down, 428 428
I'll find the option for remote logging. 429 429
When I click that, I can enable remote logging. 430 430
Then I can type in my server name, 10.1.0.246 431 431
and I'm going to put that 432 432
on port 514 because that is the port for syslog. 433 433
Now, from the remote syslog contents, 434 434
I can check the system events 435 435
and the firewall events because those are the ones I want. 436 436
And then I'll click save. 437 437
Now, if I go back 438 438
into my SIEM and I go back into Kibana, I can click 439 439
on the management tab and then select index patterns 440 440
and then we can create a new index pattern. 441 441
So in this index pattern, I'm going to call it log-syslog-star 442 442
and click Next step. 443 443
For the time filter, 444 444
again, I don't want to use the time filter 445 445
and then click create index pattern. 446 446
If I go to the discovery tab, 447 447
here I can find logstash-syslog-*. 448 448
Now, if I search for something, for instance, 449 449
syslog-sourceip: 10.1.0.254, 450 450
and then hit update, I can find all of the syslog things 451 451
that are associated with that IP address. 452 452
So at this point, we have looked at some different options 453 453
for taking information into our SIEM. 454 454
We can do it based on traffic sources, by a network tap, 455 455
we can use agents like Beats 456 456
and we can use syslog for our more generic systems 457 457
that don't have Beats installed. 458 458
Now, once we've done all that, we might have a lot 459 459
of log data coming in, so it'll be important for us 460 460
to define our use cases and tune our sensors 461 461
and tune our logging to exactly what we're looking for. 462 462
But this lab should have given you a great introduction 463 463
to Security Onion and how to set up these different things 464 464
on your network. 465 465
Again, like all the tools we've talked about in this course, 466 466
I do recommend downloading this 467 467
onto a virtual machine in your network, set up an appliance 468 468
and then start capturing your own network traffic 469 469
and see what patterns you can identify. 470 470
Learn how to read these logs 471 471
and learn how to use these tools. 472 472
It'll make you a much better cybersecurity analyst 473 473
and it'll help you pass your job interviews 474 474
because employers are going to want to know 475 475
that you know how to use a SIEM and how to read it.